Splunk Enterprise Security

How can we track changes made in correlation searches?

ManishVilla7
Explorer

I want to create a scheduled search that will track the changes made in content under Splunk Enterprise security app. If someone modifies correlation searches i want my query to capture it. Can this be achieved??

Please help.

 

Labels (1)
0 Karma
1 Solution

Jhunter
Explorer

Possibly use the rest command combined with Rich's internal search: (taken  and edited from: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Listcorrelationsearches)

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

The Updated field represents when the correlation search was updated (changed) - I tested this on my own instance. 

So, you could keep a list of enabled searches with their update times in a lookup table using that rest search. Then in a new correlation search compare the current rest results with the historic lookup table and if the update times are different - there was a change.

Then in the drill down of the correlation search you could pass the name of the search as a token and update time (using maybe earliest= and latest= in the search SPL with that token) and search on the internal index via Rich's search or something similar to find the user who made the change. 

 

 

View solution in original post

amitpanjawani
Explorer

I was searching for the same, then i developed this app for the community. https://splunkbase.splunk.com/app/4144/

Jhunter
Explorer

Possibly use the rest command combined with Rich's internal search: (taken  and edited from: https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Listcorrelationsearches)

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",")  | fields title, search, updated

The Updated field represents when the correlation search was updated (changed) - I tested this on my own instance. 

So, you could keep a list of enabled searches with their update times in a lookup table using that rest search. Then in a new correlation search compare the current rest results with the historic lookup table and if the update times are different - there was a change.

Then in the drill down of the correlation search you could pass the name of the search as a token and update time (using maybe earliest= and latest= in the search SPL with that token) and search on the internal index via Rich's search or something similar to find the user who made the change. 

 

 

wabesman_OG
New Member

Going through the audit logs I found this query helpful.

 

index=_audit action=create_saved_search actions=* app=* disabled=* info=* user=*
| table _time savedsearch user action actions app disabled info

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's no good way to do that within Splunk.  The audit logs may tell that someone touched a CS, but it won't say what changes were made.

Consider tracking your .conf files in a source management tool like git so you not only know when a change is made, but can revert to a previous instance if necessary.

---
If this reply helps you, Karma would be appreciated.

ManishVilla7
Explorer

@richgalloway can we at-least get the info of who made the change, search name, time. I am not tracking the exact change made but who all made the changes.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Start with this query.  Replace "<searchName>" with the URL-encoded name of the search you're interested in.  Or use "saved/searches" for a generic search.

index=_internal "<searchName>" sourcetype=splunkd_ui_access source="*splunkd_ui_access.log" "POST"

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...